From ccf2ba9bbbb785d69d5c9a8b43088a2abab0612c Mon Sep 17 00:00:00 2001
From: Robert Rose <robert.rose@mailbox.org>
Date: Tue, 21 Jan 2025 12:59:37 +0100
Subject: [PATCH] k3s: use available sha256sum instead of prefetching in update
 script

K3s already provides sha256 hashes of all release assets. This uses
those hashes, instead of prefetching airgap images archives.
---
 .../cluster/k3s/1_29/images-versions.json         |  8 ++++----
 .../cluster/k3s/1_30/images-versions.json         |  8 ++++----
 .../cluster/k3s/1_31/images-versions.json         |  8 ++++----
 .../cluster/k3s/1_32/images-versions.json         |  8 ++++----
 .../networking/cluster/k3s/update-script.sh       | 15 +++++++++++----
 5 files changed, 27 insertions(+), 20 deletions(-)

diff --git a/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json
index 2a2b97c4345c..f040e078905d 100644
--- a/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_29/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.12%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "0p3d0k4ckzrbd3xd4v9vb8rhw9jcl4ilx9ch94yhf8kxnnblgzyb"
+    "sha256": "cbff4797b57d22073d4990a54e23a14c260e335a3b6dd2fa682bffc9c8046d5c"
   },
   "airgap-images-arm": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.12%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "0j9ajjz201w319gfryx2q7jnmyi8gg805v7jsdmy4xkyl8ki80jw"
+    "sha256": "5c021427a27e76e26bd3f2ec02d07b28fa6ae5c1a2fbec5e0a830720be942a49"
   },
   "airgap-images-arm64": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.12%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "1yc1yafr16mli1jk9xc4vgp6q36zk9z5p4rjmdng42dp0j6kvj0w"
+    "sha256": "1cc83d8d04b709f26cab32935b7e9adf0c6ceedb84f5346588b49a909df281f9"
   },
   "images-list": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.12%2Bk3s1/k3s-images.txt",
-    "sha256": "1gqiaszfw49hsbn7xkkadykaf028vys13ykqvpkqar0f7hwwbja6"
+    "sha256": "46c9c5393c0e6485e7dd78fa11b4df4800a7a66f6ace7eecd23011eebe5611bf"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
index 20f45a47ad9f..e13c13b6bdb7 100644
--- a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.8%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "12vvc79jy1nyvcpsr2bi6w1zf28rqx99vh7anjm13snzsk7kzqc2"
+    "sha256": "82e13fcfd4dfea11aab4eac09d52c71909f703377189ac2fdbde062fd3617b8b"
   },
   "airgap-images-arm": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.8%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "0mhn1ilh830m403yg1y3nqzjcakhs3i6hgdq2s8w2spyz2kdrgv1"
+    "sha256": "61bfdca6f8fe6ac19116b83d68e2d0702a263fb6c387e70720150c04690c1656"
   },
   "airgap-images-arm64": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.8%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "0jdxf36dksypjvgil23wn8ins5rp0achmlavmv12vhijfllkqnn5"
+    "sha256": "c55a3c297532c22dc2ae5bd10a990237176d23b27c081adf96d7ebd9cc70bd49"
   },
   "images-list": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.8%2Bk3s1/k3s-images.txt",
-    "sha256": "1gqiaszfw49hsbn7xkkadykaf028vys13ykqvpkqar0f7hwwbja6"
+    "sha256": "46c9c5393c0e6485e7dd78fa11b4df4800a7a66f6ace7eecd23011eebe5611bf"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
index 7cc4d06679fa..a9eb9cb12757 100644
--- a/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.4%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "1dykfk58sp4phf125jfrzx031pp1mj0g8q0kliis139sig14vagp"
+    "sha256": "f7a94dc28b3a8da063a41360f480ace1de3040ffd9c9228283975c8dca74d3b7"
   },
   "airgap-images-arm": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.4%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "0z4h9yd8843q58hhm8jw072k1ixxnmprp9c30pwb796iy1mpirbm"
+    "sha256": "75e5786bf0d1a4b3f80583a59b6fb5bdc730c5015ca20a212a7810849a4f907c"
   },
   "airgap-images-arm64": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.4%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "0xsq095dkf89c6jjd126rrdl7k0zy7cxb38rimzpacb8zfj4ss82"
+    "sha256": "02694da4fb6831757f8d198dd5d9f11fcc435bce468426a56109b9d94a025877"
   },
   "images-list": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.4%2Bk3s1/k3s-images.txt",
-    "sha256": "1gqiaszfw49hsbn7xkkadykaf028vys13ykqvpkqar0f7hwwbja6"
+    "sha256": "46c9c5393c0e6485e7dd78fa11b4df4800a7a66f6ace7eecd23011eebe5611bf"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
index cd79731e1bbb..41ed0588db15 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
@@ -1,18 +1,18 @@
 {
   "airgap-images-amd64": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.1%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "0sn4m1djj8npdx90mny7cwc843ri9q4s0w906rgabjw2v1h56qz0"
+    "sha256": "e0635360d882cba55e362071a0094e310f821867c7db0a526fd722295ba8c46a"
   },
   "airgap-images-arm": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.1%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "1mk8xjc4zj3a6jm53drwicqsipy58faxmq990s14lqvrhh3qjnh4"
+    "sha256": "045a89078479634a820629e1da9543c5dfa8318b3cb751aa346ac84f98ec68d6"
   },
   "airgap-images-arm64": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.1%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "0s1h6lksn83r71ia61h9cjwiqigz9nw9n9jm92749782c8zi918x"
+    "sha256": "1d85143f62029d448e4855269bb84dff451cb9640906a362387920ab27353068"
   },
   "images-list": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.1%2Bk3s1/k3s-images.txt",
-    "sha256": "08qxykq9aylfgm24g8ybki62r2sdzvnmv72pan4i2nn0js93nnk9"
+    "sha256": "695a3b9296c05a118955579c5dedfe4d8b2c4c9ccba347447d8e7a95f0f41d23"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/update-script.sh b/pkgs/applications/networking/cluster/k3s/update-script.sh
index 0e4985620f45..b709703535a4 100755
--- a/pkgs/applications/networking/cluster/k3s/update-script.sh
+++ b/pkgs/applications/networking/cluster/k3s/update-script.sh
@@ -70,21 +70,28 @@ cat > chart-versions.nix.update <<EOF
 EOF
 mv chart-versions.nix.update chart-versions.nix
 
+# Concatenate all sha256sums, one entry per line
+SHA256_HASHES="$(curl -L "https://github.com/k3s-io/k3s/releases/download/v${K3S_VERSION}/sha256sum-amd64.txt")
+    \n$(curl -L "https://github.com/k3s-io/k3s/releases/download/v${K3S_VERSION}/sha256sum-arm64.txt")
+    \n$(curl -L "https://github.com/k3s-io/k3s/releases/download/v${K3S_VERSION}/sha256sum-arm.txt")"
+
 # Get all airgap images files associated with this release
 IMAGES_ARCHIVES=$(curl "https://api.github.com/repos/k3s-io/k3s/releases/tags/v${K3S_VERSION}" | \
     # Filter the assets so that only zstd archives and text files that have "images" in their name remain
-    # Modify the name and write the modified name and download URL to a string
     jq -r '.assets[] | select(.name | contains("images")) |
         select(.content_type == "application/zstd" or .content_type == "text/plain; charset=utf-8") |
-        .name = (.name | sub("k3s-"; "") | sub(".tar.zst"; "") | sub(".txt"; "-list")) |
         "\(.name) \(.browser_download_url)"')
 
 # Create a JSON object for each airgap images file and prefetch all download URLs in the process
 # Combine all JSON objects and write the result to images-versions.json
 while read -r name url; do
-    jq --null-input --arg name "$name" \
+    # Pick the right hash based on the name
+    sha256=$(grep "$name" <<< "$SHA256_HASHES" | cut -d ' ' -f 1)
+    # Remove the k3s- prefix and file endings
+    clean_name=$(sed -e 's/^k3s-//' -e 's/\.tar\.zst//' -e 's/\.txt/-list/' <<< "$name")
+    jq --null-input --arg name "$clean_name" \
             --arg url "$url" \
-            --arg sha256 "$(nix-prefetch-url --quiet "${url}")" \
+            --arg sha256 "$sha256" \
         '{$name: {"url": $url, "sha256": $sha256}}'
 done <<<"${IMAGES_ARCHIVES}" | jq --slurp 'reduce .[] as $item ({}; . * $item)' > images-versions.json